Skip to content

security: harden ember-protocol input validation #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kacy merged 1 commit into from
Feb 14, 2026
Merged

security: harden ember-protocol input validation #131

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 24 additions & 18 deletions crates/ember-protocol/src/command.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1189,9 +1189,9 @@ fn parse_f64(frame: &Frame, cmd: &str) -> Result<f64, ProtocolError> {
let v = s.parse::<f64>().map_err(|_| {
ProtocolError::InvalidCommandFrame(format!("value is not a valid float for '{cmd}'"))
})?;
if v.is_nan() {
if v.is_nan() || v.is_infinite() {
return Err(ProtocolError::InvalidCommandFrame(format!(
"NaN is not a valid score for '{cmd}'"
"value is not a valid finite float for '{cmd}'"
)));
}
Ok(v)
Expand Down Expand Up @@ -1643,6 +1643,11 @@ fn parse_slot_list(args: &[Frame]) -> Result<Vec<u16>, ProtocolError> {
let slot: u16 = slot_str
.parse()
.map_err(|_| ProtocolError::InvalidCommandFrame("invalid slot number".into()))?;
if slot >= 16384 {
return Err(ProtocolError::InvalidCommandFrame(format!(
"invalid slot {slot}: must be 0-16383"
)));
}
slots.push(slot);
}
Ok(slots)
Expand All @@ -1657,6 +1662,11 @@ fn parse_cluster_setslot(args: &[Frame]) -> Result<Command, ProtocolError> {
let slot: u16 = slot_str
.parse()
.map_err(|_| ProtocolError::InvalidCommandFrame("invalid slot number".into()))?;
if slot >= 16384 {
return Err(ProtocolError::InvalidCommandFrame(format!(
"invalid slot {slot}: must be 0-16383"
)));
}

if args.len() < 2 {
return Err(ProtocolError::WrongArity("CLUSTER SETSLOT".into()));
Expand Down Expand Up @@ -1825,10 +1835,15 @@ fn parse_vadd(args: &[Frame]) -> Result<Command, ProtocolError> {
let key = extract_string(&args[0])?;
let element = extract_string(&args[1])?;

// parse vector values until we hit a non-numeric argument or end
// parse vector values until we hit a non-numeric argument, end, or dim limit
let mut idx = 2;
let mut vector = Vec::new();
while idx < args.len() {
if vector.len() >= MAX_VECTOR_DIMS {
return Err(ProtocolError::InvalidCommandFrame(format!(
"VADD: vector exceeds {MAX_VECTOR_DIMS} dimensions"
)));
}
let s = extract_string(&args[idx])?;
if let Ok(v) = s.parse::<f32>() {
vector.push(v);
Expand All @@ -1844,13 +1859,6 @@ fn parse_vadd(args: &[Frame]) -> Result<Command, ProtocolError> {
));
}

if vector.len() > MAX_VECTOR_DIMS {
return Err(ProtocolError::InvalidCommandFrame(format!(
"VADD: vector has {} dimensions, max is {MAX_VECTOR_DIMS}",
vector.len()
)));
}

// parse optional flags
let mut metric: u8 = 0; // cosine default
let mut quantization: u8 = 0; // f32 default
Expand Down Expand Up @@ -1960,10 +1968,15 @@ fn parse_vsim(args: &[Frame]) -> Result<Command, ProtocolError> {

let key = extract_string(&args[0])?;

// parse query vector until we hit a non-numeric argument
// parse query vector until we hit a non-numeric argument, end, or dim limit
let mut idx = 1;
let mut query = Vec::new();
while idx < args.len() {
if query.len() >= MAX_VECTOR_DIMS {
return Err(ProtocolError::InvalidCommandFrame(format!(
"VSIM: query exceeds {MAX_VECTOR_DIMS} dimensions"
)));
}
let s = extract_string(&args[idx])?;
if let Ok(v) = s.parse::<f32>() {
query.push(v);
Expand All @@ -1979,13 +1992,6 @@ fn parse_vsim(args: &[Frame]) -> Result<Command, ProtocolError> {
));
}

if query.len() > MAX_VECTOR_DIMS {
return Err(ProtocolError::InvalidCommandFrame(format!(
"VSIM: query has {} dimensions, max is {MAX_VECTOR_DIMS}",
query.len()
)));
}

// COUNT k is required
let mut count: Option<usize> = None;
let mut ef_search: usize = 0;
Expand Down
Loading